PatchSiren cyber security CVE debrief
CVE-2025-11065 Red Hat CVE debrief
CVE-2025-11065 is a medium-severity vulnerability in the github.com/go-viper/mapstructure/v2 package. The flaw is located in the field processing component using mapstructure.WeakDecode, which allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts. The vulnerability was published on January 26, 2026, and last modified on June 25, 2026. The CVSS score is 5.3, indicating a medium severity level. The vulnerability is related to CWE-209. There are multiple sources referencing this vulnerability, including Red Hat and GitHub.
- Vendor
- Red Hat
- Product
- OpenShift Pipelines
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-01-26
- Original CVE updated
- 2026-06-25
- Advisory published
- 2026-01-26
- Advisory updated
- 2026-06-25
Who should care
Developers and security teams using the github.com/go-viper/mapstructure/v2 package should be aware of this vulnerability. The vulnerability allows information disclosure, which could potentially lead to security issues if exploited. Users of this package, especially those processing sensitive data, should take necessary precautions to mitigate the risk.
Technical summary
The vulnerability is caused by the mapstructure.WeakDecode function in the github.com/go-viper/mapstructure/v2 package. This function processes user-supplied data and generates detailed error messages that may contain sensitive information. An attacker could potentially exploit this vulnerability by providing malformed data to leak sensitive information. The vulnerability has a CVSS score of 5.3 and is classified as CWE-209. The affected package is widely used in Go applications for decoding and mapping data.
Defensive priority
This vulnerability should be prioritized for remediation, especially in applications handling sensitive data. The risk of information disclosure is medium, but the potential impact could be significant depending on the context in which the vulnerable package is used.
Recommended defensive actions
- Review and update github.com/go-viper/mapstructure/v2 to the latest version.
- Implement input validation and sanitization for data processed by the mapstructure.WeakDecode function.
- Configure logging to avoid leaking sensitive information in error messages.
- Monitor applications using the vulnerable package for potential security incidents.
- Consider using alternative packages or versions that are not vulnerable.
Evidence notes
The CVE record and NVD detail provide official information about the vulnerability. Red Hat and GitHub also reference this vulnerability, indicating potential impact on related products and projects. However, specific details about affected products and versions are limited.
Official resources
This article is AI-assisted and based on the supplied source corpus.